fix(auth): restore auth.py as valid Python (closes #2)

backend/app/auth.py

@@ -1 +1,83 @@
-ZnJvbSBkYXRldGltZSBpbXBvcnQgZGF0ZXRpbWUsIHRpbWVkZWx0YSwgdGltZXpvbmUKZnJvbSB0eXBpbmcgaW1wb3J0IE9wdGlvbmFsCmZyb20gZmFzdGFwaSBpbXBvcnQgRGVwZW5kcywgSFRUUEV4Y2VwdGlvbiwgc3RhdHVzCmZyb20gZmFzdGFwaS5zZWN1cml0eSBpbXBvcnQgT0F1dGgyUGFzc3dvcmRCZWFyZXIKZnJvbSBqb3NlIGltcG9ydCBKV1RFcnJvciwgand0CmZyb20gcGFzc2xpYi5jb250ZXh0IGltcG9ydCBDcnlwdENvbnRleHQKZnJvbSBweWRhbnRpYyBpbXBvcnQgQmFzZU1vZGVsCgpTRUNSRVRfS0VZID0gImNoYW5nZS1tZS1pbi1wcm9kdWN0aW9uIgpBTEdPUklUSE0gPSAiSFMyNTYiCkFDQ0VTU19UT0tFTl9FWFBJUkVfTUlOVVRFUyA9IDEyMApwd2RfY29udGV4dCA9IENyeXB0Q29udGV4dChzY2hlbWVzPVsiYmNyeXB0Il0sIGRlcHJlY2F0ZWQ9ImF1dG8iKQpvYXV0aDJfc2NoZW1lID0gT0F1dGgyUGFzc3dvcmRCZWFyZXIodG9rZW5Vcmw9Ii9hdXRoL3Rva2VuIikKCmNsYXNzIFRva2VuKEJhc2VNb2RlbCk6CiAgICBhY2Nlc3NfdG9rZW46IHN0cgogICAgdG9rZW5fdHlwZTogc3RyID0gImJlYXJlciIKCmNsYXNzIFRva2VuRGF0YShCYXNlTW9kZWwpOgogICAgdXNlcm5hbWU6IE9wdGlvbmFsW3N0cl0gPSBOb25lCgpjbGFzcyBVc2VyKEJhc2VNb2RlbCk6CiAgICB1c2VybmFtZTogc3RyCiAgICBkaXNhYmxlZDogYm9vbCA9IEZhbHNlCiAgICByb2xlOiBzdHIgPSAidmlld2VyIgoKZmFrZV91c2Vyc19kYiA9IHsKICAgICJhZG1pbiI6IHsKICAgICAgICAidXNlcm5hbWUiOiAiYWRtaW4iLAogICAgICAgICJoYXNoZWRfcGFzc3dvcmQiOiAiJDJiJDEyJGoycnJzdnpZaEM5bFE0dzZXSjF3UGVZOUNLRU1Ndm1GbzB4U2c2dTQwcUNNZ2ZIZENxa2ZHIiwKICAgICAgICAiZGlzYWJsZWQiOiBGYWxzZSwKICAgICAgICAicm9sZSI6ICJhZG1pbiIsCiAgICB9LAogICAgInZpZXdlciI6IHsKICAgICAgICAidXNlcm5hbWUiOiAidmlld2VyIiwKICAgICAgICAiaGFzaGVkX3Bhc3N3b3JkIjogIiQyYiQxMiREQTdObjRNVlNyMW0zUTBQNngxUWUuaTZ5ZDBxSjdZeDFDMlZZTFJOdktjSnN0ZVZFaDlXNiIsCiAgICAgICAgImRpc2FibGVkIjogRmFsc2UsCiAgICAgICAgInJvbGUiOiAidmlld2VyIiwKICAgIH0sCn0KCmRlZiB2ZXJpZnlfcGFzc3dvcmQocGxhaW5fcGFzc3dvcmQ6IHN0ciwgaGFzaGVkX3Bhc3N3b3JkOiBzdHIpIC0+IGJvb2w6CiAgICByZXR1cm4gcHdkX2NvbnRleHQudmVyaWZ5KHBsYWluX3Bhc3N3b3JkLCBoYXNoZWRfcGFzc3dvcmQpCgpkZWYgZ2V0X3VzZXIodXNlcm5hbWU6IHN0cik6CiAgICB1c2VyID0gZmFrZV91c2Vyc19kYi5nZXQodXNlcm5hbWUpCiAgICBpZiBub3QgdXNlcjoKICAgICAgICByZXR1cm4gTm9uZQogICAgcmV0dXJuIFVzZXIodXNlcm5hbWU9dXNlclsidXNlcm5hbWUiXSwgZGlzYWJsZWQ9dXNlclsiZGlzYWJsZWQiXSwgcm9sZT11c2VyWyJyb2xlIl0pCgpkZWYgYXV0aGVudGljYXRlX3VzZXIodXNlcm5hbWU6IHN0ciwgcGFzc3dvcmQ6IHN0cik6CiAgICB1c2VyX2RpY3QgPSBmYWtlX3VzZXJzX2RiLmdldCh1c2VybmFtZSkKICAgIGlmIG5vdCB1c2VyX2RpY3Q6CiAgICAgICAgcmV0dXJuIE5vbmUKICAgIGlmIG5vdCBwd2RfY29udGV4dC52ZXJpZnkocGFzc3dvcmQsIHVzZXJfZGljdFsiaGFzaGVkX3Bhc3N3b3JkIl0pOgogICAgICAgIHJldHVybiBOb25lCiAgICByZXR1cm4gVXNlcih1c2VybmFtZT11c2VyX2RpY3RbInVzZXJuYW1lIl0sIGRpc2FibGVkPXVzZXJfZGljdFsiZGlzYWJsZWQiXSwgcm9sZT11c2VyX2RpY3RbInJvbGUiXSkKCmRlZiBjcmVhdGVfYWNjZXNzX3Rva2VuKGRhdGE6IGRpY3QsIGV4cGlyZXNfZGVsdGE6IE9wdGlvbmFsW3RpbWVkZWx0YV0gPSBOb25lKSAtPiBzdHI6CiAgICB0b19lbmNvZGUgPSBkYXRhLmNvcHkoKQogICAgZXhwaXJlID0gZGF0ZXRpbWUubm93KHRpbWV6b25lLnV0YykgKyAoZXhwaXJlc19kZWx0YSBvciB0aW1lZGVsdGEobWludXRlcz1BQ0NFU1NfVE9LRU5fRVhQSVJFX01JTlVURVMpKQogICAgdG9fZW5jb2RlLnVwZGF0ZSh7ImV4cCI6IGV4cGlyZX0pCiAgICByZXR1cm4gand0LmVuY29kZSh0b19lbmNvZGUsIFNFQ1JFVF9LRVksIGFsZ29yaXRobT1BTEdPUklUSE0pCgpkZWYgZ2V0X2N1cnJlbnRfdXNlcih0b2tlbjogc3RyID0gRGVwZW5kcyhvYXV0aDJfc2NoZW1lKSkgLT4gVXNlcjoKICAgIGNyZWRlbnRpYWxzX2V4Y2VwdGlvbiA9IEhUVFBFeGNlcHRpb24oc3RhdHVzX2NvZGU9c3RhdHVzLkhUVFBfNDAxX1VOQVVUSE9SSVpFRCwgZGV0YWlsPSJDb3VsZCBub3QgdmFsaWRhdGUgY3JlZGVudGlhbHMiLCBoZWFkZXJzPXsiV1dXLUF1dGhlbnRpY2F0ZSI6ICJCZWFyZXIifSkKICAgIHRyeToKICAgICAgICBwYXlsb2FkID0gand0LmRlY29kZSh0b2tlbiwgU0VDUkVUX0tFWSwgYWxnb3JpdGhtcz1bQUxHT1JJVEhNXSkKICAgICAgICB1c2VybmFtZTogc3RyID0gcGF5bG9hZC5nZXQoInN1YiIpCiAgICAgICAgaWYgdXNlcm5hbWUgaXMgTm9uZToKICAgICAgICAgICAgcmFpc2UgY3JlZGVudGlhbHNfZXhjZXB0aW9uCiAgICAgICAgdG9rZW5fZGF0YSA9IFRva2VuRGF0YSh1c2VybmFtZT11c2VybmFtZSkKICAgIGV4Y2VwdCBKV1RFcnJvcjoKICAgICAgICByYWlzZSBjcmVkZW50aWFsc19leGNlcHRpb24KICAgIHVzZXIgPSBnZXRfdXNlcih0b2tlbl9kYXRhLnVzZXJuYW1lKQogICAgaWYgdXNlciBpcyBOb25lOgogICAgICAgIHJhaXNlIGNyZWRlbnRpYWxzX2V4Y2VwdGlvbgogICAgcmV0dXJuIHVzZXIKCmRlZiBnZXRfY3VycmVudF9hY3RpdmVfdXNlcihjdXJyZW50X3VzZXI6IFVzZXIgPSBEZXBlbmRzKGdldF9jdXJyZW50X3VzZXIpKSAtPiBVc2VyOgogICAgaWYgY3VycmVudF91c2VyLmRpc2FibGVkOgogICAgICAgIHJhaXNlIEhUVFBFeGNlcHRpb24oc3RhdHVzX2NvZGU9NDAwLCBkZXRhaWw9IkluYWN0aXZlIHVzZXIiKQogICAgcmV0dXJuIGN1cnJlbnRfdXNlcgo=
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+from fastapi import Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordBearer
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+from pydantic import BaseModel
+
+SECRET_KEY = "change-me-in-production"
+ALGORITHM = "HS256"
+ACCESS_TOKEN_EXPIRE_MINUTES = 120
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/auth/token")
+
+class Token(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+
+class TokenData(BaseModel):
+    username: Optional[str] = None
+
+class User(BaseModel):
+    username: str
+    disabled: bool = False
+    role: str = "viewer"
+
+fake_users_db = {
+    "admin": {
+        "username": "admin",
+        "hashed_password": "$2b$12$j2rrsvzYhC9lQ4w6WJ1wPeY9CKEMMvmFo0xSg6u40qCMgfHdCqkfG",
+        "disabled": False,
+        "role": "admin",
+    },
+    "viewer": {
+        "username": "viewer",
+        "hashed_password": "$2b$12$DA7Nn4MVSr1m3Q0P6x1Qe.i6yd0qJ7Yx1C2VYLRNvKcJsteVEh9W6",
+        "disabled": False,
+        "role": "viewer",
+    },
+}
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return pwd_context.verify(plain_password, hashed_password)
+
+def get_user(username: str):
+    user = fake_users_db.get(username)
+    if not user:
+        return None
+    return User(username=user["username"], disabled=user["disabled"], role=user["role"])
+
+def authenticate_user(username: str, password: str):
+    user_dict = fake_users_db.get(username)
+    if not user_dict:
+        return None
+    if not pwd_context.verify(password, user_dict["hashed_password"]):
+        return None
+    return User(username=user_dict["username"], disabled=user_dict["disabled"], role=user_dict["role"])
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
+    to_encode = data.copy()
+    expire = datetime.now(timezone.utc) + (expires_delta or timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES))
+    to_encode.update({"exp": expire})
+    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+
+def get_current_user(token: str = Depends(oauth2_scheme)) -> User:
+    credentials_exception = HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate credentials", headers={"WWW-Authenticate": "Bearer"})
+    try:
+        payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+        username: str = payload.get("sub")
+        if username is None:
+            raise credentials_exception
+        token_data = TokenData(username=username)
+    except JWTError:
+        raise credentials_exception
+    user = get_user(token_data.username)
+    if user is None:
+        raise credentials_exception
+    return user
+
+def get_current_active_user(current_user: User = Depends(get_current_user)) -> User:
+    if current_user.disabled:
+        raise HTTPException(status_code=400, detail="Inactive user")
+    return current_user